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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )K Responsive to communication(s) filed on 10 November 2003 . 
2a)^ This action is FINAL. 2b)\3 This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1,3-10 and 12-17 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) IEI Claim(s) 1,3-10 and 12-17 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
11 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 
Priority under 35 U.S.C. §§119 and 120 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 

a)n All b)D Some*c)D None of: 

1 Certified copies of the priority documents have been received. 

2.Q Certified copies of the priority documents have been received in Application No. . 

3-D Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

13) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 1 19(e) (to a provisional application) 

since a specific reference was included in the first sentence of the specification or in an Application Data Sheet. 
37 CFR 1.78. 

a) D The translation of the foreign language provisional application has been received. 

14) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121 since a specific 

reference was included in the first sentence of the specification or in an Application Data Sheet. 37 CFR 1 .78. 



Attachment(s) 

1) □ Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-413) Paper No(s). 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) 5) □ Notice of Informal Patent Application (PTO-152) 

3) □ Information Disclosure Statement(s) (PTO-1449) Paper No(s) . 6) □ Other: 
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DETAILED ACTION 

1. Claims 1,3-10 and 12-17 are presented for examination. Claims 1,3, 10 and 12 
have been amended; claims 2 and 11 have been canceled; claims 14-17 are newly 
added claims. 

Claim Rejections - 35 USC § 103 

2. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

3. Claims 1,10 and 14 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Gleichauf et al. (6,499,107 B1) in view of Chiu (US 5,101,402). 

4. Chiu is a prior art reference cited by Examiner on the previous Office Action. 

5. As per claims 1,10 and 14, Gleichauf teaches the invention substantially as 
claimed including a method of reconstructing a session using a first analyzer [4, Fig. 1] 
coupled to a second analyzer [5, Fig. 1] and a data collector [36, Fig. 2] the method 
comprising: 
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performing session reconstruction on packets received at a first analyzer [4, Fig. 
1; 100, 104, Fig. 4; col. 4, lines 4-7]; and 

responsive to successful session reconstruction on the first analyzer, sending a 
first message to at least one of a second analyzer [5, Fig. 1] separate from the first 
analyzer and a data collector [36, Fig. 2], the first message corresponding to session 
data [col. 8, lines 18-30]. 

6. Gleichauf does not specifically teach the steps of sending one or more messages 
comprises unrecognized packet to the second analyzer responsive to unsuccessful 
session reconstruction on the first analyzer and the second analyzer recognizes the 
unrecognized packets to successfully reconstruct the session. 

7. However, Chiu on the other hand teaches the step of sending one or more 
messages comprises unrecognized packet to the second analyzer responsive to 
unsuccessful session reconstruction on the first analyzer and the second analyzer 
recognizes the unrecognized packets to successfully reconstruct the session [Fig. 9; 
col. 8, line 61 - col. 9, line 25]. It would have been obvious to a person of ordinary skill 
in the art at the time the invention was made to combine the teaching of Gleichauf and 
Chiu because doing so would improve the functionality of the system by sharing 
information between different analyzers for recognizing a packet at the most effort 
instead of simply discard a unrecognized packet at the first analyzer. One of ordinary 
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skill in the art would have been motivated to modify Gleichauf s system with Chiu's 
sending step to improve the performance of the system. 

8. Claims 1-17 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
McCreery etal. (US 5,787,253) in view of Chiu (US 5,101,402). 

9. As per claims 1, 6 and 14, McCreery teaches the invention substantially as . 
claimed including a method of reconstructing a session using a first analyzer [336, Fig. 
4c] coupled to a second analyzer [346, Fig. 4c] and a data collector [342, Fig. 4c] the 
method comprising: 

performing session reconstruction analysis on packets received at the first 
analyzer [col. 2, lines 20-22]; and 

responsive to successful session reconstruction on a first analyzer, sending a 
first message to at least one of a second analyzer and the data collector, the first 
message corresponding to session data [col. 2, lines 22-24 & 34-39]. 

10. McCreery does not specifically teach steps of sending one or more messages 
comprises unrecognized packet to the second analyzer responsive to unsuccessful 
session reconstruction on the first analyzer and the second analyzer recognizes the 
unrecognized packets to successfully reconstruct the session. 
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1 1 . However, Chiu on the other hand teaches the step of sending one or more 
messages comprises unrecognized packet to the second analyzer responsive to 
unsuccessful session reconstruction on the first analyzer and the second analyzer 
recognizes the unrecognized packets to successfully reconstruct the session [Fig. 9; 
col. 8, line 61 - col. 9, line 25]. It would have been obvious to a person of ordinary skill 
in the art at the time the invention was made to combine the teaching of McCreery and 
Chiu because doing so would improve the functionality of the system by sharing 
information between different analyzers for recognizing a packet at the most effort 
instead of simply discard a unrecognized packet at the first analyzer. One of ordinary 
skill in the art would have been motivated to modify McCreery* s system with Chiu's 
sending step to improve the performance of the system. 

1 2. As per claims 3-4 and 1 5-1 6, McCreery teaches that the one or more messages 
from the first analyzer to the second analyzer further comprise a time the packet was 
received and an address information for the packet [col. 2, lines 22-24]. 

1 3. As per claims 5 and 17, McCreery teaches the step of filtering the packets before 
them reach the first analyzer [col. 2, lines 16-20]. 

14. As per claims 7-9, McCreery teaches that the second analyzer performing the 
session reconstruction based on the messages received from first analyzer and sending 
a second message to the data collector [col. 2, lines 34-39]. 
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1 5. As per claims 10-13, since they are system claims of claims 1 -9, they are 
rejected for the same basis as claims 1-9 above. 

16. Claim 1-17 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Abromavage et al. (WO 00/6881 1 ). 

17. Abromavage is a prior art reference cited by Applicant, filed on 6/25/01 . 

18. As per claims 1 , 6 and 14, Abromavage teaches the invention substantially as 
claimed including a method of reconstructing a session using a first analyzer coupled to 
a second analyzer [112, 120, Fig. 1] and a data collector [122, Fig. 1] the method 
comprising: 

performing session reconstruction analysis on packets received at the first 
analyzer [col. 5, lines 14-19; col. 6, lines 3-10]; and 

responsive to successful session reconstruction on a first analyzer, sending a 
first message to at least one of a second analyzer and the data collector, the first 
message corresponding to session data [col. 6, lines 14-22]. 

19. Abromavage does not specifically teach steps of sending one or more messages 
comprises unrecognized packet to the second analyzer responsive to unsuccessful 
session reconstruction on the first analyzer and the second analyzer recognizes the 
unrecognized packets to successfully reconstruct the session. 
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20. However, Chiu on the other hand teaches the step of sending one or more 
messages comprises unrecognized packet to the second analyzer responsive to 
unsuccessful session reconstruction on the first analyzer and the second analyzer 
recognizes the unrecognized packets to successfully reconstruct the session [Fig. 9; 
col. 8, line 61 - col. 9, line 25]. It would have been obvious to a person of ordinary skill 
in the art at the time the invention was made to combine the teaching of Abromavage 
and Chiu because doing so would improve the functionality of the system by sharing 
information between different analyzers for recognizing a packet at the most effort 
instead of simply discard a unrecognized packet at the first analyzer. One of ordinary 
skill in the art would have been motivated to modify Abromavage's system with Chiu's 
sending step to improve the performance of the system. 

21 . As per claims 3-4 and 15-16, Abromavage teaches that the one or more 
messages from the first analyzer to the second analyzer further comprise a time the 
packet was received and an address information for the packet [col. 5, lines 14-19; col. 
6, lines 14-15 & 23-27]. 

22. As per claims 7-9, Abromavage teaches that the second analyzer performing the 
session reconstruction based on the messages received from first analyzer and sending 
a second message to the data collector [col. 6, lines 16-27; col. 10, lines 3-7]. 
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23. As per claims 1 0-1 3, since they are system claims of claims 1 -9, they are 
rejected for the same basis as claims 1-9 above. 

24. Claims 5 and 17 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Abromavage et al. (WO 00/6881 1) in view of McCreery et al. (US 5,787,253). 

25. As per claims 5 and 17, Abromavage teaches the invention substantially as 
claimed in claim 1 . Abromavage does not specifically teach that the packets received at 
the first analyzer are output from a filter for controlling which packets in a plurality of 
packets flowing into the filter reach the first analyzer. 

26. However, McCreery on the other hand teaches the step of filtering the packets 
before them reach the first analyzer [col. 2, lines 16-20]. It would have been obvious to 
a person of ordinary skill in the art at the time the invention was made to filter the 
packets before analyzing the packets because doing so would relief the burden of the 
system by avoiding analyzing undesired packets. One of ordinary skill in the art would 
have been motivated to modify Abromavage's system with McCreery's filter to increase 
the efficiency of the system. 

Conclusion 

27. Applicant's arguments with respect to claims 1-17 have been considered but are 
moot in view of the new ground(s) of rejection. 
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28. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP §706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

29. A shortened statutory period for reply to this final action is set to expire 
THREE MONTHS from the mailing date of this action. In the event a first reply is 
filed within TWO MONTHS of the mailing date of this final action and the advisory 
action is not mailed until after the end of the THREE-MONTH shortened statutory 
period, then the shortened statutory period will expire on the date the advisory 
action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be 
calculated from the mailing date of the advisory action. In no event, however, will 
the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

30. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jinsong Hu whose telephone number is (703) 306 - 
5932. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John A. Follansbee, can be reached on (703) 305-8498. The fax number for 
this Group 2100 is (703) 872-9306. 
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Any inquiry of a general nature or relating to the status of the application should 
be directed to the Group receptionist at (703) 305-3900. 

Jinsong Hu 

January 14, 2004 A 




